electrode-ota-ui-app

{"schema_version":"1.7.4","id":"MAL-2026-12368","published":"2026-08-05T13:02:11Z","modified":"2026-08-06T23:29:18.826479841Z","summary":"Malicious code in electrode-ota-ui-app (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498)\nPackage targets the electrode-io internal name `electrode-ota-ui-app` with an inflated 99.0.1 version to win dependency resolution against a private registry. package.json declares both `main: index.js` and `scripts.postinstall: node index.js`, so on `npm install` and on any `require()` the package unconditionally runs `collectAndSend()` in index.js. That function gathers host identifiers via `os.hostname()`, `os.userInfo()`, `os.platform()`, and `os.release()`, resolves the installer's public IP via ipify and geo/ISP data via ipapi.co, and POSTs a JSON payload to the hardcoded Burp Collaborator subdomain `https://itfv50wbocctx0j32fyfq8z7uy0ptdn1c.oastify.com/callback`, controlled by the package author. README self-labels as a dependency-confusion PoC, but the callback is live and any installer whose resolver picks this public package over the intended internal one is compromised.\n","affected":[{"package":{"name":"electrode-ota-ui-app","ecosystem":"npm"},"versions":["99.0.1","99.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"fde8a46daff69f5a26679e3181413871cbe2e8df62ac807439ee8398aaa40f89","tlsh":"d971ffba15f5523476f3e29dc60b82012112f1473e45ae69798c33905fcd62a63b27f9"},{"path":"README.md","sha256":"1851a185b9ad284f1227a2d49f2c46d2b66a4ebcdf16d7ad67ed695ee9ea77ae","tlsh":"1ae06159eb45f365091f06eff06075b55135a05ae0ae45c0a14c48fad807695151e11f"}],"package_integrity":[{"filename":"electrode-ota-ui-app-99.0.1.tgz","hashes":{"sha1":"9bc5f2833bb5cd0dd45521325487bb50933287d0","sha512_sri":"sha512-yUkqBrnBAwEvHy1SnXp82PxvHZXZIxuPqYyzk7DMfgzMnudOXbPtPuytKKcCEFSTlKysfpmNqtP504f3kA3GFg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/electrode-ota-ui-app/v/99.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/electrode-ota-ui-app/v/99.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014857","import_time":"2026-08-05T13:08:51.400271176Z","modified_time":"2026-08-05T13:02:11Z","sha256":"6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498","source":"amazon-inspector","versions":["99.0.1"]},{"id":"IN-MAL-2026-016677","import_time":"2026-08-06T18:09:04.74363334Z","modified_time":"2026-08-06T16:20:16Z","sha256":"1b5315221101990fa53b188dbc05de9e41f0a8663ea645f638237a46e0e1d622","source":"amazon-inspector","versions":["99.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}